depending on how your users are being managed in Google, you can perform a split based on the email address. if you have google hosting your email domain, you can do a google login step, then create a step that calls a split based on the received email address. "@mycompany.com" splits to a workflow where you provide a certificate, "@gmail.com" splits to a guest workflow.
make sure to inform your employees to use their work email address to login, not their personal or @gmail.com address. there isn't really a way to differentiate within the same email domain if they are using personal email addresses, although you could also email them a voucher prior to performing the onboarding (assuming you have a list of employee email addresses) and then require the voucher as a step in the employee split.
